CVE-2026-46637mediumCWE-116

CVE-2026-46637: medium-severity vulnerability in twigphp Twig

Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

Published · Updated

Follow this CVE+ Monitor Twig+ Monitor cssinliner-extra

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.3%
Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
twig · cssinliner-extratwig · markdown-extratwigphp · Twig
Related CVEs — twigphp Twig

In the same product, most dangerous first.

CVE-2022-23614HIGHCode injection in TwigEPSS 8.2%CVE-2022-39261HIGHTwig may load a template outside a configured directory when using the filesystem loaderEPSS 3.2%CVE-2024-45411HIGHTwig has a possible sandbox bypassEPSS 0.8%CVE-2026-24425HIGHTwig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterfaceEPSS 0.8%CVE-2026-46633HIGHTwig: PHP code injection via `{% use %}` template nameEPSS 0.7%CVE-2026-46640HIGHTwig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilationEPSS 0.6%